summaryrefslogtreecommitdiff
path: root/source3/rpc_server/srv_netlog_nt.c
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r19058: Implement "user cannot change password", and complete "user must changeJim McDonough1-1/+1
password at next logon" code. The "password last set time" of zero now means "user must change password", because that's how windows seems to use it. The "can change" and "must change" times are now calculated based on the "last set" time and policies. We use the "can change" field now to indicate that a user cannot change a password by putting MAX_TIME_T in it (so long as "last set" time isn't zero). Based on this, we set the password-can-change bit in the faked secdesc. (This used to be commit 21abbeaee9b7f7cff1d34d048463c30cda44a2e3)
2007-10-10r16409: Fix Klocwork ID's.Volker Lendecke1-0/+5
1177 In reg_perfcount.c: 1200 1202 1203 1204 In regfio.c: 1243 1245 1246 1247 1251 Jerry, the reg_perfcount and regfio.c ones, can you take a look please? This is really your code, and I'm not sure I did the right thing to return an error. smbcacls.c: 1377 srv_eventlog_nt.c: 1415 1416 1417 srv_lsa_nt.c: 1420 1421 srv_netlog_nt.c: 1429 srv_samr_nt: 1458 1459 1460 Volker Volker (This used to be commit d6547d12b1c9f9454876665a5bdb010f46b9f5ff)
2007-10-10r16241: Fix Klocwork #106 and others like it.Jeremy Allison1-10/+14
Make 2 important changes. pdb_get_methods() returning NULL is a *fatal* error. Don't try and cope with it just call smb_panic. This removes a *lot* of pointless "if (!pdb)" handling code. Secondly, ensure that if samu_init() fails we *always* back out of a function. That way we are never in a situation where the pdb_XXX() functions need to start with a "if (sampass)" test - this was just bad design, not defensive programming. Jeremy. (This used to be commit a0d368197d6ae6777b7c2c3c6e970ab8ae7ca2ae)
2007-10-10r16054: Janitor for Volker ? Volker - some reason you didn'tJeremy Allison1-2/+1
fix this in 3.0 ? Jeremy. We had no way to return NT_STATUS_OK from the netlogon serverpwset, although we successfully set the machine password... One thing the samba3 join test found. Volker (This used to be commit e5b7acc9b5cb6e8cf3d03c9d392fad06e0d282d9)
2007-10-10r14450: Fix more get_md4pw() breakage caused by missing "breaks"Gerald Carter1-0/+3
in the switch statement which matched the schannel type against the account type. (This used to be commit 57c705ea63381ed9ab09145b4f57a736931fa6ca)
2007-10-10r14448: * protect against NULL cli_state* pointers in cli_rpc_pipe_open()Gerald Carter1-3/+4
* Fix inverted logic check for machine accounts in get_md4pw() (This used to be commit a36529535dcb5a262e7627b80fb62a31240dc8ad)
2007-10-10r14443: rework get_md4pw() to ease debugging. The only functional change is thatGünther Deschner1-24/+69
we now check wheter the sec_channel_type matches the trust account type. Guenther (This used to be commit c35eb449375d53ffa0815897e7723c203be1f732)
2007-10-10r13711: * Correctly handle acb_info/acct_flags as uint32 not as uint16.Günther Deschner1-2/+2
* Fix a couple of related parsing issues. * in the info3 reply in a samlogon, return the ACB-flags (instead of returning zero) Guenther (This used to be commit 5b89e8bc24f0fdc8b52d5c9e849aba723df34ea7)
2007-10-10r13590: * replace all pdb_init_sam[_talloc]() calls with samu_new()Gerald Carter1-3/+8
* replace all pdb_{init,fill}_sam_pw() calls with samu_set_unix() (This used to be commit 6f1afa4acc93a07d0ee9940822d7715acaae634f)
2007-10-10r13576: This is the beginnings of moving the SAM_ACCOUNT data structureGerald Carter1-12/+12
to make full use of the new talloc() interface. Discussed with Volker and Jeremy. * remove the internal mem_ctx and simply use the talloc() structure as the context. * replace the internal free_fn() with a talloc_destructor() function * remove the unnecessary private nested structure * rename SAM_ACCOUNT to 'struct samu' to indicate the current an upcoming changes. Groups will most likely be replaced with a 'struct samg' in the future. Note that there are now passbd API changes. And for the most part, the wrapper functions remain the same. While this code has been tested on tdb and ldap based Samba PDC's as well as Samba member servers, there are probably still some bugs. The code also needs more testing under valgrind to ensure it's not leaking memory. But it's a start...... (This used to be commit 19b7593972480540283c5bf02c02e5ecd8d2c3f0)
2007-10-10r13571: Replace all calls to talloc_free() with thye TALLOC_FREE()Gerald Carter1-3/+3
macro which sets the freed pointer to NULL. (This used to be commit b65be8874a2efe5a4b167448960a4fcf6bd995e2)
2007-10-10r13557: (Hopefully) get the creds store/restore key right fromJeremy Allison1-18/+35
the correct part of the netlogon and schannel packets. Jeremy. (This used to be commit 4877f336b257e6f59833a6e0679959a2ec879974)
2007-10-10r13556: Ensure that any potential creds operation are protectedJeremy Allison1-14/+31
by schannel if "server schannel = true" was set. Jeremy. (This used to be commit fd84d9703ed01feb010df4ebb7e9ceb0d063780b)
2007-10-10r13553: Fix all our warnings at -O6 on an x86_64 box.Jeremy Allison1-2/+2
Jeremy. (This used to be commit ea82958349a57ef4b7ce9638eec5f1388b0fba2a)
2007-10-10r13548: Always use the get_remote_macinhe_name() as the keyJeremy Allison1-49/+47
for the creds store. This should fix the problems Jerry reported (but I have still to run tests :-). Jeremy. (This used to be commit 43f095a38d66caa774d80fe32e1b96ec25dd1f07)
2007-10-10r13544: -O1 janitor work :-)Volker Lendecke1-6/+5
(This used to be commit a95d7d722273863efa820674672393fe6e5a33b7)
2007-10-10r13539: Add 128 bit creds processing client and server. Thanks to Andrew ↵Jeremy Allison1-2/+4
Bartlett's Samba4 code. Jeremy. (This used to be commit a2fb436fc5dd536cfe860be93f55f9cb58139a0e)
2007-10-10r13519: Fix the credentials chaining across netlogon pipe disconnects.Jeremy Allison1-43/+126
I mean it this time :-). Jeremy. (This used to be commit 80f4868944d349015d2b64c2414b06466a8194aa)
2007-10-10r13449: Ensure we don't crash if no dc struct on pipe.Jeremy Allison1-1/+1
Jeremy. (This used to be commit a9e1d0f3b4fd7a0732a5023d0b4dcc2c4b1b03f8)
2007-10-10r13447: Added LSA_LOOKUPSIDS2 and LSA_LOOKUPSIDS3.Jeremy Allison1-1/+5
Jeremy. (This used to be commit a164cfab420a2439dad8fd85f8b4d652087fa6b9)
2007-10-10r13439: Fix NET_SAM_LOGON_EX.Jeremy Allison1-0/+1
Jeremy. (This used to be commit 9437ffc84f4d924ab67f3e16ef507d2aeeeb5f34)
2007-10-10r13436: Add in NET_SAM_LOGON_EX. Still needs testing.Jeremy Allison1-12/+54
Jeremy (This used to be commit f58d0ebf749ad6dab562e74e9fd2c16606183d6c)
2007-10-10r13434: Add stub for NET_SAM_LOGON_EX.Jeremy Allison1-0/+10
Jeremy. (This used to be commit 58544eb3c848e1dddd774270fbaae7d704a37b53)
2007-10-10r13407: Change the credentials code to be more like the Samba4 structure,Jeremy Allison1-6/+2
makes fixes much easier to port. Fix the size of dc->sess_key to be 16 bytes, not 8 bytes - only store 8 bytes in the inter-smbd store in secrets.tdb though. Should fix some uses of the dc->sess_key where we where assuming we could read 16 bytes. Jeremy. (This used to be commit 5b3c2e63c73fee8949108abe19ac7a448a033a7f)
2007-10-10r13399: Get closer to passing RPC-SCHANNEL test.Jeremy Allison1-5/+9
Jeremy. (This used to be commit 8ae70122b79fbe682c227ec2c4e5a72bf58d76de)
2007-10-10r13316: Let the carnage begin....Gerald Carter1-46/+50
Sync with trunk as off r13315 (This used to be commit 17e63ac4ed8325c0d44fe62b2442449f3298559f)
2007-10-10r13147: Raise creds_server_step fail log messages to debug level 2.Jeremy Allison1-3/+3
These can happen in normal operation (I think - not 100% sure) and don't want to alarm admins. Jerry please add this to 3.0.21b. Jeremy. (This used to be commit 47178b1b5ad06905f345a0f6b6267701d8aefddb)
2007-10-10r11917: Move nt_token_to_group_list to srv_netlog_nt.c. srv_util.c is empty now.Volker Lendecke1-0/+29
Volker (This used to be commit ae4ffc1cfb745a756d047c35f947f80acf4b0e55)
2007-10-10r11617: fix typoGerald Carter1-1/+1
(This used to be commit 37d2bf02f37f6d1b5bac9523f085c00625722761)
2007-10-10r11573: Adding Andrew Bartlett's patch to make machine accountJeremy Allison1-1/+4
logons work if the client gives the MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT or MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT flags. This changes the auth module interface to 2 (from 1). The effect of this is that clients can access resources as a machine account if they set these flags. This is the same as Windows (think of a VPN where the vpn client authenticates itself to a VPN server using machine account credentials - the vpn server checks that the machine password was valid by performing a machine account check with the PDC in the same was as it would a user account check. I may add in a restriction (parameter) to allow this behaviour to be turned off (as it was previously). That may be on by default. Andrew Bartlett please review this change carefully. Jeremy. (This used to be commit d1caef866326346fb191f8129d13d98379f18cd8)
2007-10-10r11137: Compile with only 2 warnings (I'm still working on that code) on a gcc4Jeremy Allison1-2/+2
x86_64 box. Jeremy. (This used to be commit d720867a788c735e56d53d63265255830ec21208)
2007-10-10r10792: Fix the "schannel not stored across client disconnects" problem.Jeremy Allison1-4/+6
Based on the Samba4 solution - stores data in $samba/private/schannel_store.tdb. This tdb is not left open but open and closed on demand. Jeremy. (This used to be commit a6d8a4b1ff31c5552075455dbd98cb58795958a9)
2007-10-10r10724: Got a little ahead of myself...Jeremy Allison1-1/+0
Jeremy. (This used to be commit 86ffef8162393be3da81fda13772f0f1d40b0d08)
2007-10-10r10722: Remove unused BOOL in struct dcinfo.Jeremy Allison1-0/+4
Ensure that the mach_acct and remote machine entries are set correctly in struct dcinfo - we'll need this as a key for a persistent schannel state later. Jeremy. (This used to be commit 47269b5c7161d740c2e86227de3acd9e08c53817)
2007-10-10r10656: BIG merge from trunk. Features not copied overGerald Carter1-122/+147
* \PIPE\unixinfo * winbindd's {group,alias}membership new functions * winbindd's lookupsids() functionality * swat (trunk changes to be reverted as per discussion with Deryck) (This used to be commit 939c3cb5d78e3a2236209b296aa8aba8bdce32d3)
2007-10-10r10269: Server-side fix for creds change - revert jcmd's change.Jeremy Allison1-8/+2
Jeremy. (This used to be commit e1c9813d63a441037bc71622a29acda099d72f71)
2007-10-10r9261: Fix #2976: windows member servers wouldn't alloc connections from usersJim McDonough1-0/+9
defined locally because if we didn't find them as a DC we were marking the response as authoritative. Now if it's not a domain we know, we mark the response non-authoritative. Fix from jpjanosi@us.ibm.com (This used to be commit d522277b86ff728f6f2b9feb2f8e3fa38c43d162)
2007-10-10r9242: Fix my fix for #2953. I'd moved too much code until after we verify ↵Jim McDonough1-3/+3
the user, causing netlogon to return an invalid response for failed interactive logons. (This used to be commit 4deb918b682fb51d8712cfdafc6210275dd10fc4)
2007-10-10r9112: Fix #2953 - credentials chain on DC gets out of sync with client whenJim McDonough1-5/+12
NT_STATUS_NO_USER returned. We were moving to the next step in the chain when the client wasn't. Only update when the user logs on. (This used to be commit b01a3a4111f544eef5bd678237d07a82d1ce9c22)
2007-10-10r8432: Fix #2077 - login to trusted domain doesn't allow home drive map and ↵Jim McDonough1-2/+7
login scripts to be executed. We were filling in our name as the server which processed the login, even when it was done by a trusted DC. Thanks to John Janosik <jpjanosi@us.ibm.com> for the fix. (This used to be commit 0446319a3b8096df385978449ffaa231bc5cfd0c)
2007-10-10r7217: Only allow schannel connections if a successful Auth2 has been doneVolker Lendecke1-0/+2
before. Things tested: Domain join and subsequent interactive and network logon to NT4, W2kSP and XPSP2 workstations and a NT4 domain trusting us. Right now I've got problems with my W2k3 domain trusts. So this needs testing, although I'm really confident that this does not break. Volker (This used to be commit c25b4afda2b657b73a6215d3ff36461a36496ba3)
2007-10-10r7139: trying to reduce the number of diffs between trunk and 3.0; changing ↵Gerald Carter1-6/+0
version to 3.0.20pre1 (This used to be commit 9727d05241574042dd3aa8844ae5c701d22e2da1)
2007-10-10r6225: get rid of warnings from my compiler about nested externsHerb Lewis1-2/+3
(This used to be commit efea76ac71412f8622cd233912309e91b9ea52da)
2007-10-10r4088: Get medieval on our ass about malloc.... :-). Take control of all our ↵Jeremy Allison1-1/+1
allocation functions so we can funnel through some well known functions. Should help greatly with malloc checking. HEAD patch to follow. Jeremy. (This used to be commit 620f2e608f70ba92f032720c031283d295c5c06a)
2007-10-10r2761: Print the decrypted, not encrypted key.Andrew Bartlett1-2/+2
Andrew Bartlett (This used to be commit 1833d0ab724d88411ebd79ac26f5642e7c8cfee3)
2007-10-10r2137: This is a patch I've been running at Hawker for a while.Andrew Bartlett1-19/+29
The purpose of this patch is to avoid changing the machine account password, when it has 'already been changed'. This occours in situations where the secure channel between the workstation and the DC breaks down, such as occoured in the MS04-11 security patch. This avoids LDAP replication load issues, due to the client changing the password repeatedly. We also now set the LM password to NULL explicitly, rather than the NT password value, as this is what we get out of a vampire, or when a long password is set (as XP seems to do these days). Andrew Bartlett (This used to be commit 1ad1317a815898b52b1803211ab7b502e331e782)
2007-10-10r1492: Rework our random number generation system.Andrew Bartlett1-1/+1
On systems with /dev/urandom, this avoids a change to secrets.tdb for every fork(). For other systems, we now only re-seed after a fork, and on startup. No need to do it per-operation. This removes the 'need_reseed' parameter from generate_random_buffer(). Andrew Bartlett (This used to be commit 36741d3cf53a7bd17d361251f2bb50851cdb035f)
2007-10-10r991: Allow winbindd to use the domain trust account passwordGerald Carter1-13/+56
for setting up an schannel connection. This solves the problem of a Samba DC running winbind, trusting a native mode AD domain, and needing to enumerate AD users via wbinfo -u. (This used to be commit e9f109d1b38e0b0adec9b7e9a907f90a79d297ea)
2007-10-10r196: merging struct uuid from trunkGerald Carter1-0/+17
(This used to be commit 911a28361b9d8dd50597627f245ebfb57c6294fb)
2007-10-10r69: Global rename of 'nt_session_key' -> 'user_session_key'. The session ↵Andrew Bartlett1-7/+7
key could be anything, and may not be based on anything 'NT'. This is also what microsoft calls it. (This used to be commit 724e8d3f33719543146280062435c69a835c491e)
generated by cgit (git 2.34.1) at 2024-11-10 07:43:01 +0000